PXLQuill / Guide 20
Scoring and classification
Record severity, technical validation and classifications deliberately.
01 / Begin with demonstrated impact
Set the finding severity using the observed impact and the actual assessment context. Keep assumptions and untested consequences explicit in the narrative.
02 / Use the supported scoring controls
Where you use CVSS, select the supported metrics and review the resulting score and vector. A numeric score does not replace an explanation of the customer impact. Do not imply a finding was technically confirmed merely because it has a score.
03 / Add relevant classifications
Use the CWE reference and OWASP Top 10 mapping for classifications supported by the finding. Select the appropriate available OWASP edition and categories. Mapping is recorded classification, not evidence of comprehensive coverage of every category.
04 / Keep status fields separate
Technical validation describes the evidence behind the issue; remediation describes the follow-up state. Check both independently of severity and report inclusion. Review the generated finding register before delivery.